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(54)Title: CIPHERING APPARATUS 



(57) Abstract 

A ciphering apparatus of common key type, wherein a 
plurality of rounding units are connected in cascade, the i-th 
rounding unit is fed with input data Lj , R t , the input data R t are 
subjected to nonlinear transformation by a nonlinear function unit 
depending upon the key data, the exclusive-OR output of the output 
of the nonlinear function unit and the input data L t is outputted as 
data R i+1 to the (i+l)-th rounding unit, and the input data Rj are 
outputted as data L i+1 to the (i+l)-th rounding unit. The nonlinear 
function unit includes: a key-dependent linear transforming unit for 
subjecting the input R ; to key-dependent linear transformation; a 
dividing unit for dividing the output into four data in 0 , in! , in 2 and 
in 3 ; first nonlinear transforming units for subjecting the divided 
data to nonlinear transformation to output data midoo , mid^ , mid^ 
and mid^ ; a key-dependent linear transforming unit for correlating 
these transformed outputs to each other and subjecting them to 
lineal- transformation based upon the key data to output data midi 0 , 
mid n , mid 12 and mid l3 ; second nonlinear trasnforming units for 
subjecting the transformed outputs to nonlinear transformation to 
output data outo , out } , out 2 and out 3 ; and a coupling unit for 
coupling the transformed outputs to output data Y. 
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mm 

*iaSS5ai3pBff-^"C*>5 DE S (Data Encryption Standard) B£#;&Sfc5 0 

illi, D E S Bf -^-rottlffifil^cSr^-t-o D E S Pf^-CH:, 5 6 f y f ©i^f 
3r/f§v\ 6 4 try h©f-^yn y^^tJmf^k*ytfi^^-«rtT5o Hi l£*3 

— ^Ro »i@ 2 i ®7 KftLSSP 1 4 i (i=0, 1, -.15) ©^©HT*t 
B8«:SS[»«P (7 KIH»£Pm;h/0^5) l 2— AXZth, 4 8t'^o^ 
4iko (DfflW<Dt>k\zf(Ro, ko) }^&£*l5o -co^t^^— (Ro, ko) tzf 

Ri = Lo ®f (Ro, ko) 

Li = Ro (1) 
Z.<D £ ? i^2o©^o y^^—^Lo, Ro^rA^J^ LT^^gP 1 2 £: SMttLttflJI 

jKW^sa^bttSo w, i ®7 K««.aifp i 4 . ^xsmmzm i ja©^?^ k 

klz~TZ> 0 fcfcU i=0, ••, 15 -CfcSo KAQ-a^Pl 
4 . (0 ^ i < 1 5) Tli, 

R i + 1 = L. ©f (Ri, ki) 
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Li + i=Ri (2) 

Ttt, B8»f l-A^i"5t£^:fiiko, k>, k,«, k. 5^Mi^ttS:iSte$*T, 
k, 5 , ki*, ki, ko<Dm\zAt}-rZ£5fc'tZ>&&mirt£ x P&fftMi^C 

C*5^tBttJWfeti 1 1 A^J It 1 1 ©^l^^trtS * 1 1: <t ^ ft 

$M£iti s^Hi^^^t/i^^ffii^nSo Mm, ftH-a^^^K^aaiasi 4 

CTfeS. **3, t£^:«ko, ki, ki4, kisfi, Bf ■ztittUsM k Wft\o)fc-Xm*. 

fig/V— 6-C5 6 h <Z>ig$$&«&&S 4 8 tTy hCDlfcJzmi 6l@tf>th768 tTy 

r. tbt^l£^:« k , £ -e^ftH^f^fp ^xorhiki 8 t>, 4 8 tf ^ h v e — * 

E(R.)©k«Kl3g|feL7!:gL 8fl§cD6t* s/ h r"^;t^7'n s> ? 7*—*^ ^f'J-T6 0 
#4rj)S4 h^>m^Sr#5„ fc*5, r<£>S-box Si(j=l,-,8) tt6lfyh<7)A 
SBf^0>;*:«ttfc£^t*&©oT^5&#Tfc5o S-box S. ~S 8 O8o<£>tti 
T, @8t^$*L5«J:5fc:, Li bWi&#)Miimfa&frZm&f(om*if(Ri, ki) 

*%%-MWtmi^h^Xm-<Z 0 DE S Bf ir-TS ^3fe©*3i«B|p-i- 

te&T&*ftjfefl?8l£$fe"T?$>5<£>J& s E. Biham St^A. ShamirtCl J;otSl$tifc 
^^?ic^ ( "Differential Cryptanalysis of DES-like Cryptosystems. " Pr 
oceedings of CRYPTO' 90) 1 £ o T $ ^fejU^Kfe ( "DESBf-^ 
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(Dmmmmm (i) , " 1 9 9 3m%-%rtmn-t*~vy"^ v-^v^ascisqs 

-3C) tfe5„ 

AX= X © X* (3) 

1^14: T^A^o s^t*— *£L*i, R*i^i"5 0 ^ *b fcff 1 &t>*H 2 ¥5: 
^A^^tbfc^ ^©W^jBf^^-tH-^nit^D-CfcS tt5„ _bSB5£(3) (D^li 

ALi =Li ©L*i 

ARi =Ri ©R* i (4) 
Tfc5o ili^^^T, Lis=Ri4, L*is=R*i4, L I 6=R I5) L* 1 6 =R* i a *OT% 
Rj 6 =Li s ©f (Ri s, ki s) 

R*i6 = L*, 5 ©f(R*is, kis) (5) 
ARi e = ALi s ©f (Li e, k ls )©f(Li6 © ALie, kis) (6) 

*<ommt ar,4=al, 5 k<oww&mwto&Mz^b\z&*)fr<Dttt 

f(Lis, ki5)©f((Li6 © ALie), kis) = ARie © ARi< (7) 
~COt%, Lie, ALie, AR, 6 teffi-^-Xfab^btlZ-?— fVib&WWLtoHDft 
*-Cfc5o Z (Ditto, #Sl£i&'j&SAR.4$rjEL< £ 5 bfcf, _L5£ 

Ilk jstf^dMcfcUS&t fc!> x UE^oospi: . Rf (DjjfiSr/BV^Tk , 5 |cif5^ 

ARi + i = ALi ©A{f(ARi)} 
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AL i + i = ARi + i (8) 

te^Uki <omiz.Mt>ib-r, mmp . -cau^ar,)} sr^aj-e^-sfcv^^K: 

£>5 0 d©J:5t-aaiH"e#S©tt, A {f (ARi)} &&&&&& 
&-?fc5S-box ^gp^f£ttT*fc<9 % L/^t>S-box fc^T, A^^l- £o T« 

Mffi^ro^i-ifct^^^I^^cstftT^S,, 0»J*.fc£, s-box s, *c 
ra\ a^£-"iioioo"co£ f , 1/4 cD?s^-cai^ii^"ooio"^^$tL6fc^-e 

7 5> KT^jSM&iS^LTV^ r ARi 4 f«^P=n Pi T'ALo, ARo ( AL 

o, ARo nW-JCfrb&tbtiZ^— ^"Cfc5^Tlt*n©iS«-Cfe5) a> ft 

k , 6 j&S3fc«>£>jft5 t , ^SttlS^^V^l 5SDESB|f^ 

^J^fe^rliko £-CjK«>tv><„ 

Biham 6^«t5^, r03«PSlEfe-ett, 2 4 7 £&tf>iiiR $ ftfcgoji^:*: • Kg^X<D 

(Lo, Ro) • r(Lo, Ro)©(Li6, Rie) • r(Lie, Rie) 

= (ko, ki, k ]S ) • r(ko, ki, ki 6 ) (9) 
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(Lo, Ro) • r(Lo, Ro)e(Li 6 , Rie) • r(Li 6 , Rie) 

(k 0j ki, — , kia) • r(ko, ki, ki 8 ) (l^F) 
<Dtii&&febtLZ> tV^5 - t li/jlSo rtf><b£, (Lo, Ro), (L 16 , R^m^^-? 

o, Ro), r(Lie, Rie), r(k 0 , ki, k, 5 ) $rIEL<3fc«>5r fcd s "e#3;fee> 
«\ (ko, k., kis) • r(ko, k,, ki 8 ) (lfcr^H lr*fc5Ci^t't 

S-box iZttl-ZAtl^Xtm^-^Z-bfttckZ, J*¥p .I"? tfiJfc-e;* 
^ AS S: T £ 3 £ v ^3 ^ i: fc: 3 0 - tutt , WM^m^-r — y^X* th -5 S-box 

csfc&f^&r Mx.f±\ s-box s s -ett, At)-^^^m"oioooo"(Dt 3/ 
i6(D^^T-i±i^^^^{ii"iiii''^^?|ij^n5/ci6-e&s 0 rtb^s-box t^tts 

SiSLTV^< r(Lo, Ro), r(Li6, R, 8 ), r(ko, ki, kis) 

P=2 n_1 n |p.-l/2| (10) 

5 o 

t^#i:J:5h rwasgBSrc, 2 45 m.(D®t%a¥-$: • ut^-^M&^-c, de 

Srl^^-rCl tTfcofCo 0<J;U*\ DE S*ff#S: 3oo^}f fcTriple-DESBf-^-ft, 
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DECODE S Bt^-COBt^kjg^fiPentium P C ^ 7 * ^jfalOMbps-CfcS fc. Trip 
le-DESl£#-tt>fc5£#J3. 5Mbps £-T?Bfr i&5(g-pt- 3 „ ~^X\ * ;y 

f§ 1 (D&mtem&&<D& *<Dmti \? v vmmxmm^n 5 mi <om.m^mM 
*(D$&i<Dffl&m&&<Dmj3V'y hmv-^fcitt^xi^mjfr^&ft 

s-box <Dm.*w^n%mmm „ ^^^^KOTtst^^mip i ^ P 
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mm f fc^M (Ajjtmttfr&mtjft -efesti, 

£;H3fci#>, m>-16/{log a (pb)}Sr?Slfeii:fiJ:< . Pbir^fctitfDE 

m i i«©de sHt^gcoa^^^^-rnio 
m 3 n^(omm(Dmmm i <z>«itB»fi&&^-riiio 

[H 7 Btew©#iH7g|IiafeS|J304 i-:&tt5«^i&£&354 W^M^7Fi-|g] 0 
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(i=0,l,-,n-l) tti 1 ©7 y KiW 1 2 l^jSt5»iW304 t, 
m 1 OXOR[HIS§1 3 iZMm-i-ZffiLJ&WiW^OS ^^306 kfabm&Zft 

$SA7j£|5320 frtb7<t}£fr1t7*~?\zm^\'^Xm j 7~*£.tfLU32l KlJ:>?«7*— 
{fk; koo.kio.kao; koi,kii,k2i; ko u-i) , ki ( n -n , ka <n-n ; ek} 

ti*£.f8t&ti, #iiSlt^322 \z.{%ft£tiZo Ms^pX 1 ?—* p fi«IB1SgB322 
f£S;ft/rv>3®7*— * f k (ciJ:5ll^#lOW«^^302 TfgEifcStLfctgL #J 

S8#i'J£P303 t2 0(7)7'a^^f-^Lo, Roid^fiJ $ tbSo 0tfx.fcf 6 4 f -y h <D 

Ro « N #tsEltgfl322 tiLflM^Jh/CV^fc-T*— * k oo, k.o, k 20 £: ^{dfl 0 ^ 
y »7 > KtoSgp 3 8 o ©#I^ii:Sl5304 (ciA^tK 3E&*&3ffi{-J: fl^— *Y 

— *tefttf>3S& (^Py/) J&Sfrfc)*^ Li=Ro, R.=Lo* k£tl. Li, R.^JfeW 
ilS?!)^ K^tSSiS 3 8 i i'A^^^o 

£*T> ^ i 9 ^ K^iffi 3 8 . (i=l, - , n-1) d^T, 2oOA*7o?' 
*L,, Ritz:oV>T_L|Etl^«©«!!31Sr*ft9 3SUfT5o BP*^ fHJ£5^^ 
K*Qf3g#|J3 8i HUSV^TW:* 2o©7*n5/^f-^Li, R ; f-^Ri 
tt., «tfStS$P322 ^n^nx^^my"'-^ ko,, k,. t k 2i t#(^I» 
§P304 i-A^tK ^fi»304 -C^^H^Slt, r-^Yi KlSE&StL 

tft^tiSc 7*— ^L s * ^ 5= - * R i tt£8lgfl306 •e7 t —9tiLm<Z>&&&ftt> 
ti. L i + ,=Ri, R, + ,=L.* <D£ ?\z&&tstiZ> 0 H7£iRI&8&305 {«;t }£#ft!l#J 

gfcs? pj^^ 5 t> © -e £> 5 o 
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r^&u ats^§f5309 ^fenf^t utw^f-^ c^^MSo 

jj,, t, ip^c p bH5o Mx_frilll 3 (djoV ^TA^f- * ©ft 9 J-Bf-^lStx— * £ 
A^Jb, ItT*— ^£11 3 £ raigfc, ek, ko<„-n, kn.-n, k 2 <„-,), koi, 
kn, k 2 i, koo, k, 0 , k 20 , fk &rli|I&-£-;ttU:£ <fc V^ 0 

0 4lt Vis 8 i {^^ffl$tLT^6^^M^304 ©flgggffi 

J^S:^i"o f§ i S7 ? >- K«tagp 3 8 , (OKI)-?* y 9 *f—9 R , ttfEHgB 
322 t£#*#S;h/-Cl^5«7*— *ko., k.i, k 21 £*ld#l&7£|ll$cgB304 — ©A^J 

SB341 ^J:«9^— ^Ri* ldjg|^3g«l$n5o ^-^Ri* J3:#fiJg&342 (djo^T^I 
X.if8 t"?/ h^50(7)4 0(7)T-^ino > im, in 2 , in 3 Id fc* y V ^fij £ tL3 0 40 
©f- ^ino, im, in a , insfi, ^tL^tL^^?^^^^343, 344, 345, 346(^^5 
V^T, t 5 — ^raidoo, mido,, mido;, mido3f£#H7£2Eifc $L Mi&^^MM 
&2I5347 (CA^SjUSo 

— ^ k 1 i id J: V)Wtf&®M&inZ> 0 fiP*>» ^midoo, mido., mido2, midosfi^: 

ax-enaojjss^ja oo ~3o 3 idA^^ «ii^?ij3o, k^ta;*^— * 

midoo£nridoi £©^(&ft8fcSfnj&SXOR3 1 i liJ: 9 i ^fcflBfglS^J 3 O 

2 te:j3^TA^^~*mido2£mido3©#teft^afttf s XOR 3 1 2 iz£V)tbft, 
ICXOR3 1 , ©ffi;fj t XOR 3 1 2 ©lii;#©#4&#Ji&gi?nj&SX O R 3 2 2 Id 
iDi^tlSo XOR3 1. ©ffl^3i:XOR3 2: ©tti*J ©SM&totfrJifnriSX 
OR33, !:J;I9 t^^, XOR33, © ft^ £: Ktlf— ^mido o ©#N&lft!%3g 
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fP^XOR34o \Z.£Y)btbfri. XOR3 2 2 (Dttit) b A^J^*— ^mid 03 b <DW 
fl!l6!Hlifil^XOR3 4s |i«t9fcf)H5 0 It, XOR3 4« , 3 3,, 3 2 
a , 3 4 3 (D^fa^ncDttitl tm^—fkno, ki i , , k, i2> ki , 3 b <£>#{tiL#JfmS 
fP^xOR3 5o ~3 5 S fc£ Y) b bfrlX ^ ^ft^fflmidi 0 , midn, midi a, mid 
i37&B\Jj&tlZ>o otU&l^?0 3 OsWA^f-^midoo, mido,, mido 

2, midosttffi£^liii<3lte>tt^^ Zti^tim?*— . o, km, kna, kns 

raidio= mido o ©mido a ©mido s ©ki i o 

midi i =mido2 ©midos ©ki i i 

midi 2 = midoo ©mido i ©mido a ©mido s ©ki i a 

midi s = mid oo ©mido i ©mido a ©ki ■ s (11) 

rtl^ffi^f- ^mid.o, mid,i, mid,a, midisWu ^fl^tKD^m^l 3 O 0 
— 3 0, fclffctt (bfrfcEU (C^i-^«^^§(5348 , 349, 350, 351 K:*5^T» 
v 2 '— ^outo, out!, outa, ouU\Z.ftmi&$E&£tl1Z&* ^itl^tKDieM^KDm 
tl^T — V t LT^-^gP352 ^-^-^L^tb> — z>(D^n 

«9 > 0ilttf4o©8 tf ^ hf*— OCO 3 2 If 3/ h * id If ^ h|£-££ 
tL5o ZCDr — fYi* W#»^&£G353 joV^T^-^— ^ k a i (31 J: «9 

^«^&g|$343~346, 348~351<D^:tL- : etb«, 0»J ;tfcfD E S Bt^f-^tt 3 1 o 

ts^itifROM-eM^nSo 

?F^lS£i!&$!5348~351Mol > >T & [WlliltO vL£#5V^5 0 
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4i, 347, 353 (04) % £(Dtim\£Eirz>i%m\zs-box tmm^mM^^m^ 

3 — 346, 348~351^<D^Q;S{-Si--58#^(Cj;b-<"C/ii^^«9^V^COT% V$t^riMm\Z. 
#ifc^£tfc8P348~35ifc:o^Ttt, «0c^if&^3E»*B347 /^BU^ £ 5 

;^^^348~3510«L/^ 1 ogfcV^HifeSriflB&U Stlfci-ST*--* 

5 0 #!;U:i\ «i&#iStfB3Etfc*|S347 flS|g5-?£$*VO^£#, #«^i&SB34 
9, 350£r^B&U -7*— ^mid.i, mid, 2 £3£-££|5352 I^LT^i^? 
it^^^^^^-r S^ttttiST L&l^— 2fT\ Hf-^Htit^/W 3 3 % 

&*3 N El3^jol/^T, ^t^— *£j&gP321 ll^Stf-^Ifk, koo, k.o, k 2 

0, koi, kll, ksi, ***, ko(n-l), kl(n-l), ks (n-1) , ek}<7)£.J&tem 1 (DDE S 

±IB©«fc 5 ^«^£HfcH£^3£g(£>4§-£\ #jH7£3gJfcgB343~-346, 34 

8~351<Z># 1 o^o^M^?lre&^«^fic&(-^LT«p b =2- 6 T^f6i* 

JfcSri&T 2H!ff 5^«>, BP^>x ^&gG343~346<^S£^}&£fl348~351<7)#lS& 

LTIi7')VKtn?rn = 3mi:U, P rg2" 24ra T«^T*t5^^!l 
::-C, «ttfm=4 (7^K»12S) tt5i, P^2" 96 £&i9, 
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12 . 

2 , ^#s»?^^^§P308 , m{&wm]&m&m47, 3530 v^tb**, tu< 

0 6fS, 03 CD^ 1 HJfe^JO^j8I^Mj»[$P304 (14) iZljolt^ 2SI040 

^J-CJ«tw, IS3^*3lt5«^#4W»|j^^ift«ES302 £^#*MUf^i»30 
8 ^B&LTV^o 

spSTl^^i-SA^lT*— ^ P&A;fo8B301 /O^PlP^grticiA^-r^o A2jt* 
f-^Ro fl, HIE'IS§P322 (^f*^$ttTV>5it^-^koo, boi*ti0g7 
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K*aa$P3 8 i (i=l, •••,n-l) ^1*51^ 2o©f*- *Li, R, Idol^T-hlE £ |^ 

ltlE1S^322 te^SfrTV^fc-T—^koi, k 2i ir*li»i»04 i-A^; 

fit* if-^Ri «55tfeffi306 T^— ^ffig<Z>5!^Sft*3tt. L i + I =R,, R, + l 
= L.* (Z) J; 5 (-^^^tbSo 

n7[>y Rtf>$l "9 il L-$diM(D%&M> f*— *L„, R„;Wb;h,5o CKPt*— *L», R„ 
Srftl*^«fP307 T^Ufcft, ffl;ftSS309 /^<bB# fit LtW^jf- * C £fct} 

i7Aft in 6<Dnii0ij^*Dit5^ i st^v vmm^3 8 , (Dtmtefc&M 

304 05ffil1S6fl|j*Sr^i- o Su^/i^cDA^^-^ Ri lilB1tgP322 {i^^tt 
X^^Zm^-fko, k s , t*lJl*ll^§i*»304 ^A^f-^i:45o 7*-* 
Ri tt, «0t#iH7£gEifc341 {^i^T, t*— * koill X «9 7 f — ^R.* 
$tb5o 7*— ^Ri* tt^*"i^342 iC&^T^oc^T 2 — ^in 0 , in, , in 2 , 

in 3 ^^-fi]$tL5o 4 0<0f-^ino , in, , in; , in 3 te, Zzfr^frftMMQL 
&SP343, 344, 345, 346^*5V>T^ 7^— ^midoo, mid 0J , mid 02 , mido 3 

^mtsntzm, m&vm&zsA: ia^^iiSo mmm^^ -m, m^ot? 

B^-TJ: '3l-4o©TO?ij3 Oo~3 0 3 rat?7*— ^+BStiiii^-3ttS J; v i- 

midio= mi do o ©mido 2 ©mido 3 

midii= mido2 ©mido3 

midi2= midoo ©midoi ©midos ©mido3 



WO 99/00783 PCT/JP98/0291S 

14 - 

midis= raidoo Smido i ©midoa (12) 
Z-(DWfoW&~^\ ifyWitZtltlT*— #mid, 0 , mid,,, mid, 2, mid, s #S£e£ 
^t(D b Tb<D7*- ? mid, 0, mid,3«, -^^^^^^348, 351(;L*5^-C, f 
— ^outo, out 3 (-#»^^$tLfc^, ^^gP352 d^T, 4 0©7 f -^outo, 
mid,,, mid, a , out 3 ^io©f- ^Y,* tig^S*i5, 7*— *Y,* 14, 

* k2.tJ:J;S«i«fe#j»^3Elft«fB353 tuss^x, f-^Y, fc*SU££lfc £ *k 

#&^gE&&343~346te4oM#JfcEB£H"t*3 0 , ^<7)^^SitttSS^g8 
igLTV^Wc^ rttfett^JHtf^BTtB^feSo £fc #M^&£|S348, 3 

mM<Dft1&J&& : J&&ififiW&<0 2'Z> (348, 351) b SJxT^ 5 ^ 

&3b\ if'-^ki «A;*J*&320 ^bBf^S^{-A^$tLfciitt#Ke 

y j^b^T*— ^«^321 |:iot$ft$n> iitSltSP322 fcflmSttfcT*--* 

J1IB05J: 5^»^*tLfe"&#ISia©»^; 0iJx.tt\ #»^J«343~346, 34 

8, 35i^§^iMt;^?i)£i^L-cil'$Pb=2- s -eM^T*t5J: 5 
KKftSJh/Cv^fcbfcf* ^ »J 1 t# 7 ^ ^ KIW p > ^2" 1 2 xfflSl 

m^L-tZ>- k^X*% , Bt -?H£S^ft£ LTW:^ ^ Fifcn £n=3m£ tt, ift^p 

^2- 24m -ciSja^-et s-iii/iS. m:\ m=4 (7^^Kti 2 

l^#«^#l£&353 fchZtztb, mffflm&t ftV>&%& 

nmm 3 

S3 8 tt. m 6 (7>f§ 2 ^J60d©*«I^B8«cSP3O4 fc^T«##a&?££Sia&353 



WO 99/00783 PCT/JP98/02915 

15 . 

fc^HHSiftSo s*^— *Ro tt, glf2ltS|S322 (^JtiTV^tr-^ 
Lo tt|&|$ft3tft305 -CiS#$;h„ ^-^Lo* II^^So 7=-^Lo* ^7=*- 

Li, Riiz^>\,^x±mtmm(D® 1 m%:m i 9ULff o a bp^* 2o©7-ni, r.^ 

OV^T, t-^Ri tts $tfEltgB322 £ *lTV^«7*— * k ■ 

7f2g§ffcgB304 (dA^J^tb, #^^M304 -C^^^S^SttT. t 5 — *Y, id 

Li + i=Rj, R 1 + i=Li* yn^f-n i + 1 , R. + i *SW^7$tt5o 

307 -cm&Llt& % mt)^309 a>*tbv& J &J:k\sTmJj7 s —*c&mj]'1rZo 

$c£fl304 ^©A^f-^Ri #il£ltg&322 (-f^^nTVN^Ii^— ^ k i £ 
*(-^#^^341 ^(DAfikteZa f-^Ri tt, mfc&tikJ&U&34l \Z. 

^§ijgfl342 |^^T4 0©r-^ino, im, ina, in 3 i^ftWl £ tb5 0 4 0<Z)t= — 
^ino, in 1, in 2 , in 3 «, ^Xh^fh^W&^k^ZW, 344, 345, 346{£*D^-t, 
^midoo, mido:, mid 02 , midost^^fF^&^frfc^ H?i^i&gfl354 (dA 

midio= mi do 0 ©midos ©midos 

midi 1 = midoa ©mido3 

midi2= mido 0 ©mido 1 ©mido 2 ©mido 3 




WO 99/00783 



PCT/JP98/02915 



midi s = midoo 0mido i ©mi do 2 



(13) 



^IBM^M "7 s "' — ^ mi d 1 o , midn, mid 12 , midi 3 &r£Ejti~<£>o oV^"C% t*— ^ 
midio, midjsfS, *ifr^frf$1ffi&WMRS48, 351tJl*5V^-C. out 3 {£ 

JS^SP352 t^^T, 4 0©f-^outo, mid, , , mid 12 , 
out a aSlO0>^— ft, «^^M304 ^e><©W^J-7*-^Y,- 

^^^^$P343~346«4oM^IJ(-ieg$tbT^ 9 , * <D&&tikmttfoE.\zM 

fc*3, if-^ki fct, «A;*J«S320 /^B£^eft^A^£ftfc#tt##Key 
ii^tf- *3lJ&£fl321 laot'M^tl, $S!2ligB322 i£^$ftfc^— 

_tfE£>J; 5 ftfcH£-^fitf>i§l^> $l;Ltt\ ^W^^^IfP343~346, 34 

Bf^fR^ff^ Lttt? 1 ?^ KSfcn&n=3m£ LT, P =g 2~ 2 4 m 

ST*#5rtl^^o dd-C, 093.8! m=4 (7^K»12a) tt5i, 

jl^^*^-^ #»^MM304 *<*)##$ias342 tt4ftmKmb-r, &n<?> 

0 7ASt;09l^tfcj:5lu2o©^i:tS^t^T?#5o 

tt£#j&^3EifetfM s 6fi (343~346, 348, 351) O^l-oV^ , 1 7 £ ^ Kffc 

1 St/ 2 KLtf LfcD E S H£-S§-|£fi<Z)4§^ £ Jttfc LT#C<£>^M 
^•To fcfcU r©Hfl^I0ftliDE SOS-box ^*J-J^-r-5#i^^^^$P34 



WO 99/00783 PCT/JP98/02915 

17 

3 ~346 ^(DKtS'T — ^ (D^M^y h^C^r 3 2 t U fi£oT, *#*U£3E*feff|$^© 

box <Z>1M X&8 try h £ t^oTS-box 4fa£ LTJfc|fcL;fc.o 





1 SSfc»9 © 
S-box $c 


1 ^H3fc <9<£> 






DE S 


4 


2 -6 


1 7 


6 8 




6 


2 - 12 


9 


5 4 



WO 99/00783 



PCT/JP98/02915 



18 . 



WO 99/00783 



PCT/JP98/02915 



19 

6. w^js i jsm5<D\,^-rM^mffi<w%^mizft\,^x, Jtiea;^— 

^ * ^a^m srf? o x p&tsi © m J) t -r 5 mwmm^u ^wt n b nx 
10. m^mi 7bm.9<D\ f ^-rfri>*iz.ftm(Di&qrmm\z.$5\ f ^x. ±mmm<D^m 

1 1. ffsfcJS 1 0 ld|S«6^)Bt^B(-*5V^T, ±SS^2^^^§P{i_h|S4o 



WO 99/00783 



PCT/JP98/02915 



20 . 

R Zfm 4 ^ ?U ^ tt-^HlS: tL"C v > 5 0 

-tiafs 3 ^uratt ibtu ±15^ 2 sNtti^fmSip coffin t ±ie^ i ^ftumjs^s 
ti t <D$mm&m%i*mn-f zw, 5 gN!iift!&Ji?p £ , 



WO 99/00783 



PCT/JP98/02915 




WO 99/00783 



PCT/JP98/02915 




WO 99/00783 



3/9 



PCT/JP98/02915 



301 



302 

303 
38 0 ^ 



fk 



305 



^ it 



0 v 



Y o ^ 304 



306 



Rn"~l 



305 



saw "1 J 



^304 



r 

38, 



306 



j 



f _ L 



(n-1) 



305. 



21 



30 



mmmm 



L (n-1) 



'(n-1) 



306 



1 

(n-1) 



38 



n-1 



307 
308 
309 



k 20 



koi> kn, 
k 21 



k()(n-1)> 
k 1(n-1)' 
k 2(n-1) 



ek 



J 




S3 



WO 99/00783 PCT/JP98/02915 

4/9 



mmm^m 304 



2s_ 



341 



342 



m&mm&& 



mm 



343 



in. 



344 



mm 



347 



,n i 345 
A. 



mm 



mid 



oo 



in. 



346 



mm 



mid 



01 



in 



mm 



mid 



32 



mid 



03 



30r 



mid 



10 



mm 



348 



352 



353 



mid 



11 



30, 



mm 



out 0 349^ 



mid 



D2 



30, 



mm 



0Ut i 350 7 



mid 



13 



mm 



out, 



7 

351 



OUto 



&o □ §P 



n&mmmm 



k 1i 



<2i 



322 



SB 



Y, 



El 4 



WO 99/00783 



5/9 



PCT/JP98/02915 




WO 99/00783 



PCT/JP98/02915 



6/9 



301 



i 



303 

38 0 



Z3Z 



305 



£ 



Y o ^ 304 



r 



306 



Rn~l 



k 00' k 20 



305 



r. 

38! 



Y^304 



r 



306 



3£^SB 



koi. k 2i 



I 



r ' 

I L (n-1) 



305. 



30^ 



-(n-1) 



38 n -i 



'(n-1) 



306 



1 



>i): 



•tyn-l)' 
k 2(n-1) 



307 

309 



3 



J 

StfD^S c 



322 



mm 

key 



320 



321 



£/&gB 



WO 99/00783 



PCT/JP98/02915 




WO 99/00783 



PCT/JP98/02915 



8/9 



301 



303 
38 0 VJ 



Z3Z 



305 



2\ y 



Y o ^ 304 



O v 



306 



Ro""l 



305 



1 



L* 



1 



1 304 
306 



38i 



T 



J 



r r 

I L (n-1) 



305. 



3 ^ V 



L (n-1) 



T (n-1) 
306-v, 



Vi) 



38 



n-1 



307 
309^ 



Rn 



— r~ 



J 

fcBt)^-^ c 



mm 

key 




18 



WO 99/00783 



PCT/JP98/02915 



9/9 



Ri 



tmimsm 304 



34 l. 

342 



mm 



354 



mm 



mid 



oo 



mm 



mid 



01 





in 0 




in 2 


in 3 


343^, 


r 344 ^ 


L_ ^ 


r 346^ 


r 



mm 



mid 



02 



mid 



mid 



10 



348 



outp 



352 r 



mid 



11 



mid 



02 



mid 



03 



13 



351 

V 



OUto 



r 



322 



Yi 



[519 



INTERNATIONAL SEARCH REPORT 



International application No. 

PCT/JP98/02915 



A. CLASSIFICATION OF SUBJECT MATTER 
Int. CI 6 G09C1/00, H04L9/06 



According to International Patent Classification (IPC) or to both national classification and IPC 



B. FIELDS SEARCHED 



Minimum documentation searched (classification system followed by classification symbols) 
Int. CI 6 G09C1/00, H04L9/06 



Documentation searched other than minimum documentation to the extent that such documents are included in the fields searched 
Jitsuyo Shinan Koho 1922-1996 Toroku Jitsuyo Shinan Koho 1994-1998 

Kokai Jitsuyo Shinan Koho 1971-1998 Jitsuyo Shinan Toroku Koho 1996-1998 

Electronic data base consulted during the international search (name of data base and, where practicable, search terms used) 



C. DOCUMENTS CONSIDERED TO BE RELEVANT 



Category* Citation of document, with indication, where appropriate, of the relevant passages Relevant to claim No. 

A WO, 98/09705, Al (Mitsubishi Electric Corp.), 1-13 

13 March, 1997 (13. 03. 97), 
Full text ; Figs. 1 to 29 
& AU, 6629396, Al & NO, 972052, A 
& EP, 790595, Al 

A Mitsuru Matsui, "Provable Safety of Differential 1-13 
Decoding and Linear Decoding of Block Cipher 
(in Japanese)", Preprint of the 18th Symposium on 
Information Theories and their Applications, 
The Institute of Information Theories and their 
Applications, Vol. 1 of 2 
October 1995 (10. 95) p. 175-178 

A Mitsuru Matsui, et al . , "Practical Block Cipher 1-13 

Having Provable Safety of Differential Decoding and 
Linear Decoding (in Japanese)", Symposium on Cipher 
and Information Security, SCIS96, Information 
Security Research Special Committee of IEICE, 
January 1996 (01. 96) SCIS96-4C 



x~| Further documents are listed in the continuation or' Box C. 



* Special categories of cited documents: 

"A" document defining the general state of the art which is not 

considered to be of particular relevance 
"E" earlier document but published on or after the international filing date 
"L" document which may throw doubts on priority claim(s) or which is 

cited to establish the publication date of another citation or other 

special reason (as specified) 
"O* document referring to an oral disclosure, use, exhibition or other 

means 

T document published prior to the international filing date but later than 
the priority date claimed 



Date of the actual completion of the international search 
17 September, 1998 (17. 09. 98) 



Name and mailing address of the ISA/ 

Japanese Patent Office 

Facsimile No. 



| [ See patent family annex. 

"T" later document published after the international filing date or priority 

date and not in conflict with the application but cited to understand 

the principle or theory underlying the invention 
"X" document of particular relevance; the claimed invention cannot be 

considered novel or cannot be considered to involve an inventive step 

when the document is taken alone 
"Y" document of particular relevance; the claimed invention cannot be 

considered to involve an inventive step when the document is 

combined with one or more other such documents, such combination 

being obvious to a person skilled in the art 
u &" document member of the same patent family 



Date of mailing of the international search report 

29 September, 1998 (29. 09. 98) 



Authorized officer 



Telephone No. 



Form PCT/ISA/210 (second sheet) (July 1992) 



INTERNATIONAL SEARCH REPORT 



International application No. 

PCT/JP98/02915 



C (Continuation). DOCUMENTS CONSIDERED TO BE RELEVANT 



Category* 


Citation of document, with indication, where appropriate, of the relevant passages 


Relevant to claim No. 


A 
P, A 


JP, 9-54547, A (NEC Corp.)/ 

25 February, 1997 (25. 02. 97), 

Full text ; Figs. 1 to 11 (Family: none) 

Masato Kanda, et al., "Structure of Round Function 
Using a Little S-box (Part 1) (in Japanese)", 
Technical Research Report of IEICE (ISEC97 14-22), 
Vol. 97, No. 181, 18 July, 1997 (18. 07. 97) p. 41-52 


1-13 
1-13 



Form PCTASA/210 (continuation ot second sheet) (July 1992) 



m%kmffi&% PCT/JP9 8/0 2 9 1 5 



a. &wv>m-t (HRttrKHB (ipo ) 

Int. CI" G09C1/00, H04L9/06 



[nt. CI' G09C1/00, H04L9/06 



0*ffl3lffligrSg2:$8 1 9 2 2- 1 9 9 6? 

s^m^mmmmm^m 1971-1998? 

0*BS&3I.E$frlg;&$8 1 9 9 4- 1 9 9 8? 

0 ^mmmmm^^ 1996-1998? 



c. 



WO, 98/09705, Al (HM$M*5*:#I±) 
13. 3j3. 1997(13. 03. 97) 
fj|l-29|i3 

& AU| 6629396, Al & NO, 972052, A & EP, 790595, Al 

tnnmmib^^jfcm^, vol. 1 of 2 

10^. 1995(10.95) p. 175-178 



1-13 



1-13 



0 cffllOTgg#jcfcJtit^syij^$ti.-cv^. 



Xift (SlStrffrf) 

roj amzjizmm* mm. m^^mR-r^xsik 



r&j IH— '<<r> H77 5 y-3tsfc 



17. 0 9. 9 8 



2 9.09.98 



SIS 



0#l3«Fg*Jf ( I S A/ J P) 
S5fig§-^- 1 0 0-8 9 1 5 
m^^ftfflESdiKHTB 4#3 % 



#* ; Si: 



5 J 



4 2 2 9 



03-3581-1101 



3 5 3 8 



i^PCT/ISA/2 10 (M2'<->*) (1 9 9 2?7fl) 



m&ttim&%- PCT/JP98/029 1 5 



c mt) . 












A 


18. 1996(01.96) SCIS96-4C 


1-13 


A 


JP, 9-54547, A (B*««C«^tt) 
25.2^.1997 (25.02.97) 
£X £1-110 (77*>-fcL) 


1-13 


P. A 


i). 

n*mnmte&£mimttn&(isEC97 14-22) , vol. 97, no. isi, 

18.7^.1997 (18.07.97) p. 41-52 


1-13 



iSPCT/ISA/2 10 (J62^-S*B«£) (1 9 9 2^7^) 



